6 matches found
CVE-2026-119330
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...
EUVD-2026-114377
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...
CVE-2026-119330
The photo and video management solution Immich is vulnerable to an improper authorization issue in versions prior to 3.2.0 . The SharedLinkService.create() function in server/src/services/shared-link.service.ts failed to validate all input fields, allowing an authenticated attacker who knows a vi...
CVE-2026-119330 Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...
CVE-2026-119330 Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...
CVE-2026-119330: immich-app immich: Immich is a high-performance self-hosted photo and video management solution
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...